Raw Stack Dump of all threads (part 3)
Sometimes the script featured in part 1 doesn’t work because of the lack of symbols or something else:
***
***
*** Your debugger is not using the correct symbols
***
*** In order for this command to work properly, your symbol path
*** must point to .pdb files that have full type information.
***
*** Certain .pdb files (such as the public OS symbols) do not
*** contain the required information. Contact the group that
*** provided you with these symbols if you need this command to
*** work.
***
*** Type referenced: ntdll!_NT_TIB
***
Couldn’t resolve error at ‘ntdll!_NT_TIB *)@$teb)->StackLimit; r? $t2 = ((ntdll!_NT_TIB *)@$teb)->StackBase; !teb; dps @$t1 @$t2′
^ Extra character error in ‘~*e r? $t1 = ((ntdll!_NT_TIB *)@$teb)->StackLimit; r? $t2 = ((ntdll!_NT_TIB *)@$teb)->StackBase; !teb; dps @$t1 @$t2′
This is the case where !teb WinDbg command doesn’t work and we can cope with this as shown in the following post:
Coping with missing symbolic information
Therefore we can adjust our user-mode script to use hard-coded offsets and delineate raw stack outputs by the output of kv WinDbg command:
~*e r? $t0 = @$teb; r? $t1 = @$t0+8; r? $t2 = @$t0+4; kv 100; dps poi(@$t1) poi(@$t2)
- Dmitry Vostokov @ DumpAnalysis.org -
November 16th, 2009 at 8:27 pm
After moving to 64-bit Windows 2008 (IIS7), we’ve started receiving the same output for !address and !teb (ntdll.pdb size is 2,157,568 - and only is found in the symbol folder). Most commands that don’t rely on this symbol seem to be working. Is there a workaround that will allow us to continue using these commands as opposed to having to hand-write scripts with specific offsets?
November 16th, 2009 at 11:22 pm
Are you using the latest WinDbg? I check tomorrow with W2K8 64-bit and let you know. I had some problems with 64-bit !teb but don’t remember with which OS version
November 17th, 2009 at 1:32 pm
Yes, using the latest: WinDbg, 64-bit SOS, 64-bit MSCORWKS, 64-bit SOSEX, Symbol Path http://msdl.microsoft.com/download/symbol; the configuration is correct, so we suspected issues with the public symbols, but it turns out a simple .reload is the cure (apparently, it’s required once).